From 85604a02d4a70442062831cd17db0484e50b306e Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Wed, 6 Jun 2018 16:50:24 -0700 Subject: [PATCH] psp updates --- .../concepts/global-configuration/_index.md | 15 +++- .../adding-a-pod-security-policy/_index.md | 83 ++++++++++++------- 2 files changed, 69 insertions(+), 29 deletions(-) diff --git a/content/rancher/v2.x/en/concepts/global-configuration/_index.md b/content/rancher/v2.x/en/concepts/global-configuration/_index.md index 7d5e983d68c..9a14d843ddd 100644 --- a/content/rancher/v2.x/en/concepts/global-configuration/_index.md +++ b/content/rancher/v2.x/en/concepts/global-configuration/_index.md @@ -134,8 +134,14 @@ The following table lists each custom global permission available and whether it Cluster and project roles define user authorization inside a cluster or project. You can manage these roles from the **Global > Security > Roles** page. From this page you can: +<<<<<<< HEAD - Lock/unlock roles so that they may not be used in any new role assignments (existing assignments will still be enforce). - Create and manage new roles for use across all clusters and projects. +======= +- Create and manage new roles for use across all clusters and projects +- [Lock/unlock roles](#locked-roles) so that they may not be used in any new role assignments (existing assignments will still be enforce) + +>>>>>>> psp updates #### Membership and Role Assignment @@ -251,7 +257,14 @@ This is the URL of your Rancher Server. All nodes in your cluster must resolve t ## Pod Security Policies -_Pod Security Policies_ are objects that control security-sensitive aspects of pod specification. Pods only run within Kubernetes if they meet the conditions specified in their assigned Pod Security Policy. +_Pod Security Policies_ (or PSPs) are objects that control security-sensitive aspects of pod specification (like secrets). Pods only run within Kubernetes if they meet their assigned PSP. + +- You can apply PSPs at the cluster or project level. +- PSPs work through inheritance. + + - By default, PSPs applied to a cluster are inherited by its projects, as well as any namespaces applied to those projects. + - **Exception:** Namespaces un-applied to projects do not inherit PSPs. Because these namespaces have no PSPs, workload deployments to these namespaces will fail, which is the default Kubernetes behavior. + - You can override the PSPs that a project inherits by applying a different PSP directly to the project. Read more about Pod Security Policies in the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). diff --git a/content/rancher/v2.x/en/tasks/clusters/adding-a-pod-security-policy/_index.md b/content/rancher/v2.x/en/tasks/clusters/adding-a-pod-security-policy/_index.md index 3f42fd71811..7de870b3f64 100644 --- a/content/rancher/v2.x/en/tasks/clusters/adding-a-pod-security-policy/_index.md +++ b/content/rancher/v2.x/en/tasks/clusters/adding-a-pod-security-policy/_index.md @@ -4,41 +4,68 @@ weight: 3475 draft: true --- -You can add a [Pod Security Policy]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/#pod-security-policies) to either a _Cluster_ or a _Project_. _Pod Security Policies_ set on a _Cluster_ act as a default and are applied to all _Namespaces_ assigned to _Projects_ within that _Cluster_. Default _Pod Security Policies_ can be overridden by setting a _Pod Security Policy_ on a project. _Namespaces_ that are not assigned to a _Project_ within a _Cluster_ are not given a _Pod Security Policy_. As a result, all new _Workload_ deployments within those _Namespaces_ will fail (this is the default Kubernetes behavior). +_Pod Security Policies_ are objects that control security-sensitive aspects of pod specification. You can add a Pod Security Policy (PSPs hereafter) to either a cluster or project. For more information about PSPs, refer to [Pod Security Policy]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/#pod-security-policies). ## Pod Security Policies and Clusters -### Create a Cluster with a default Pod Security Policy -1. Ensure a _Pod Security Policy_ exists. Refer to the [Adding Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/) task for details. -1. On the __Add Cluster__ screen under the __Cluster Options__ accordion select __Enabled__ for __Pod Security Policy Support__. - >Note that not all cloud providers support _Pod Security Policies_ and this option may not be shown. Also if no _Pod Security Policy_ are defined in Rancher then this option will be greyed out. -1. Select a _Pod Security Policy_ from the dropdown. -1. Fill out the rest of the _Cluster_ information and create it as normal. -1. When the _Cluster_ has finished provisioning the _Pod Security Policy_ that you selected will be applied to all the projects within that cluster. +### Create a Cluster with a default Pod Security Policy + +1. Ensure a PSP exists. Refer to the [Adding Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/) task for details. + +2. On the __Add Cluster__ screen under the __Cluster Options__ accordion select __Enabled__ for __Pod Security Policy Support__. + + >Note that not all cloud providers support PSPs and this option may not be shown. Also if no PSP are defined in Rancher then this option will be greyed out. + +3. Select a PSP from the dropdown. + +4. Fill out the rest of the _Cluster_ information and create it as normal. + +5. When the _Cluster_ has finished provisioning the PSP that you selected will be applied to all the projects within that cluster. ### Add a Pod Security Policy to an existing Cluster -1. Ensure a _Pod Security Policy_ exists. Refer to the [Adding Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/) task for details. -1. Click the vertical ellipsis next to the _Cluster_ you want to enable _Pod Security Policies_ for. -1. Select __Edit__. -1. On the __Edit Cluster__ screen under the __Cluster Options__ accordion select __Enabled__ for __Pod Security Policy Support__. Note that not all cloud providers support _Pod Security Policies_ and this option may not be shown. Also if no _Pod Security Policy_ are defined in Rancher then this option will be greyed out. -1. Select a _Pod Security Policy_ from the dropdown. -1. __Save__ the _Cluster_. -1. When the _Cluster_ has finished updating the _Pod Security Policy_ that you selected will be applied to all the projects within that cluster. + +1. Ensure a PSP exists. Refer to the [Adding Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/) task for details. + +2. Click the vertical ellipsis next to the _Cluster_ you want to enable PSPs for. + +3. Select __Edit__. + +4. On the __Edit Cluster__ screen under the __Cluster Options__ accordion select __Enabled__ for __Pod Security Policy Support__. Note that not all cloud providers support PSPs and this option may not be shown. Also if no PSP are defined in Rancher then this option will be greyed out. + +5. Select a PSP from the dropdown. + +6. __Save__ the _Cluster_. + +7. When the _Cluster_ has finished updating the PSP that you selected will be applied to all the projects within that cluster. ## Pod Security Policies and Projects + ### Create a Project with a Pod Security Policy. -1. Ensure a _Pod Security Policy_ exists. Refer to the [Adding Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/) task for details. -1. Navigate to a _Cluster_ with _Pod Security Policy Support_ enabled. -1. On the __Projects/Namespaces__ screen click __Add Project__. -1. On the __Add Project__ screen select a _Pod Security Policy_ from the dropdown. -1. Fill out the rest of the information as usual. -1. Click __Create__. -1. The _Project_ will create with the selected _Pod Security Policy_ applied. + +1. Ensure a PSP exists. Refer to the [Adding Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/) task for details. + +2. Navigate to a _Cluster_ with _Pod Security Policy Support_ enabled. + +3. On the __Projects/Namespaces__ screen click __Add Project__. + +4. On the __Add Project__ screen select a PSP from the dropdown. + +5. Fill out the rest of the information as usual. + +6. Click __Create__. + +7. The _Project_ will create with the selected PSP applied. ### Add a Pod Security Policy to an existing Project -1. Ensure a _Pod Security Policy_ exists. Refer to the [Adding Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/) task for details. -1. Navigate to a _Cluster_ with _Pod Security Policy Support_ enabled. -1. __Edit__ a _Project_. -1. Select a _Pod Security Policy_ from the dropdown. -1. Click __Save__. -1. The _Project_ will have the selected _Pod Security Policy_ applied. + +1. Ensure a PSP exists. Refer to the [Adding Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/) task for details. + +2. Navigate to a _Cluster_ with _Pod Security Policy Support_ enabled. + +3. __Edit__ a _Project_. + +4. Select a PSP from the dropdown. + +5. Click __Save__. + +6. The _Project_ will have the selected PSP applied.